LTECH-532: Override tomcat-embed to 11.0.22 to patch CVEs

[damienpalacio]

Summary

• Spring Boot 4.0.6 manages tomcat-embed-core 11.0.21, which is affected by 7 open Dependabot advisories (3 CRITICAL, 3 HIGH, 1 LOW).
• Pin tomcat.version to 11.0.22 (the first patched release) via the Spring dependency-management property, forcing all three embedded tomcat modules to the patched version.

Resolves the following GitHub Security Alert tickets:

• LTECH-523 — Digest authenticator authenticates any unknown user (CRITICAL)
• LTECH-524 — LockOutRealm case-sensitive user names (HIGH)
• LTECH-525 — WebSocket authentication header exposure (HIGH)
• LTECH-526 — HTTP/2 request headers not validated (CRITICAL)
• LTECH-527 — Unbounded read in WebDAV LOCK/PROPFIND (HIGH)
• LTECH-532 — Security constraints not correctly applied (CRITICAL)
• LTECH-533 — AJP secret compared in non-constant time (LOW)

Test plan

• ./gradlew dependencies confirms tomcat-embed-core/el/websocket all resolve to 11.0.22
• ./gradlew build (compile + tests) passes

🤖 Generated with Claude Code